Bind social-login state to the initiating browser

A short-lived HttpOnly cookie ties each social login state to the browser that started the login.